Legal

Privacy
Notice.

Your data is yours — we just look after it. UK GDPR compliant. Last updated February 2026.

UK GDPR

Fully compliant since 2018

Zero ads tracking

No Facebook · No Google Ads pixel

Your rights honoured in 30 days

No fees ever

1. Who we are

Around the World Holidays Ltd (Company No. 16997352) — registered office 4th Floor, 205 Regent Street, London W1B 4HB — is the data controller for personal data collected via www.aroundtheworldltd.com, phone (020 4615 4042), email (info@aroundtheworldltd.com), WhatsApp (+44 20 4615 4042) and our offices in Canada and the United States. Our UK Information Commissioner's Office registration is held under the company name above.

2. What we collect

(a) Identity & contact — name, email, phone, passport details (only when issuing tickets), address. (b) Booking data — itinerary, traveller details, payment session IDs (we never store full card numbers — those stay with Stripe / Worldpay). (c) Technical — IP, device, browser, cookies for security and analytics (anonymised). (d) Marketing — newsletter opt-ins. (e) Anti-fraud — basic deliverability checks on email and phone format. We do NOT collect data of minors directly — bookings for under-18s are added by an adult.

3. Why we use it

Lawful bases under UK GDPR Article 6: (a) contract — to fulfil your booking. (b) legal obligation — to verify identity, anti-fraud, and meet ATOL / IATA reporting. (c) legitimate interests — to improve service, recover abandoned carts (max 2 emails, easy unsubscribe), respond to inquiries. (d) consent — newsletters and cookies. You can withdraw consent any time.

4. Who we share with

Only suppliers needed to deliver your trip: airlines, hotels, transfer companies, cruise lines, visa authorities. Payment processors (Stripe, Worldpay, PayPal). Travel insurance partners (only on opt-in). Email delivery (Resend/Postmark). Government when legally required (e.g. APIS data for flights). We do NOT sell your data to anyone — ever.

5. International transfers

Our offices and some suppliers are outside the UK (Canada, USA). Transfers happen under UK Adequacy Decisions where they apply, Standard Contractual Clauses elsewhere, with additional encryption-at-rest in our cloud.

6. How long we keep it

Booking records — 7 years (HMRC + ATOL audit requirement). Inquiries that never convert — 24 months then deleted. Newsletter — until you unsubscribe. Server logs — 90 days. You can ask us to delete sooner where legally possible.

7. Your rights

You may request access, correction, deletion, restriction, portability and to object to processing. Email privacy@aroundtheworldltd.com — we respond within 30 days, no fee. You also have the right to lodge a complaint with the UK ICO (ico.org.uk) or your local supervisory authority.

8. Cookies

Essential cookies (cart, session) — no consent needed. Analytics cookies (Plausible — no third-party transfer, no personal data, no cross-site tracking) — opt-out via your browser. We do not use Facebook Pixel, Google Ads remarketing pixels, or any third-party advertising trackers.

9. Security

Bank-grade TLS 1.3 in transit, AES-256 at rest. Card data is tokenised by PCI-DSS Level 1 processors. Staff access is role-based, MFA-enforced, and audit-logged. Annual penetration tests. In the unlikely event of a breach we notify the ICO within 72 hours and you without undue delay.

10. Children

We do not knowingly process personal data of children under 16 without adult consent. Bookings that include minors require an adult to enter their details.

11. Changes to this notice

When we update this notice we post the new version with a 'Last updated' date and notify all registered customers by email if changes are material. Last updated: February 2026.